cursor-ask

cursor:ask — Read-Only Cursor Delegate

cursor-agent (Composer) に read-only A lightweight skill that delegates questions, investigations, design consultations, and adversarial reviews.

cursor-companion.sh task is run with no arguments, --mode ask (hard read-only stop) is added automatically, so--write unless file writing / command execution is not possibleis passed, the cursor side cannot

Quick Reference

cursor:ask "この設計判断、Composer 視点でどう思う？"
cursor:ask "TASK_BASE_REF からの diff を読んで、見落としを 3 つ挙げて"
cursor:ask "harness-mem の cross-project N-call、楽観的すぎる前提はある？"

Uses:

Case	Examples
Question	"What is the root cause of this type error?"
Investigation	"List all places under scripts/ that use curl, with reasons"
Design consultation	"Can this abstraction be maintained 3 years from now?"
Adversarial perspective	"Give just one biggest weakness of this PR"

Narration Rules (UX Contract)

The enemy is verbosity , not progress reporting.At startup, briefly state what you will ask and how you will proceed, then execute. Prohibit only verbose repetition and empty preambles.

What must always be output at startup (banner + plan, within 3 lines)

🚀 cursor / composer-2.5-fast / ask
これから: <質問の要点> を composer に投げて、結果を 3-5 行で要約

Banner 1 line + plan 1-2 lines. Output within 1 second, then immediately go to Step 2.

Progress reports may be given

1 line at delegation start (→ composer に問い合わせ中)
Context needed for judgment in 1 line

Prohibited (= verbosity)

Restating the same fact twice: Do not re-explain the cursor-companion result later
Empty preamble: Lines like "I will check the usage" that are obvious from the tool call
Recapping context in 3 or more lines: Compress to 1 line if needed
★ Insight blocks during the startup sequence: Insight only once in the final summary

Violation example (verbose):

× 「cursor に質問を投げる準備をします」→ bash → 「投げます」（中身のない前置き + 言い換え）
× 「ask モードは読み取り専用なので安全です」と再説明（既知事実の繰り返し）
× ★ Insight ──── まず cursor の状態を確認します: ...

Good example (concise + explicit plan):

🚀 cursor / composer-2.5-fast / ask
これから: 設計の弱点を composer に問い、結果を 3-5 行で要約

Execution Flow

Step 0: Startup banner + plan

Following the Narration Rules above, output banner + plan (within 3 lines), then go to Step 1.

Step 1: Check banner

Since Step 0 already outputs the banner + plan (within 3 lines), here confirm that the banner line is present. The banner is:

🚀 cursor / composer-2.5-fast / ask

After that, you may show progress with a 1-line status at delegation start, etc. Avoid only verbose repetition.

composer-2.5-fast は scripts/model-routing.sh --host cursor --role worker --field model Representative notation for the value resolved by . The actual resolved model appears in the cursor-companion-side log.

Step 2: Resolve helper root + run cursor-companion directly

$ARGUMENTS Pass as the question text.--write Never add。scripts/cursor-companion.sh If you call with a relative path, it will not be visible directly under the consumer repo's cwd and will exit, soCLAUDE_PLUGIN_ROOT / HARNESS_PLUGIN_ROOT resolve with the same valid_root pattern as hooks.json (Issue #193 §2):

QUESTION="$ARGUMENTS"
if [ -z "$QUESTION" ]; then
  echo "ERROR: question required. Usage: cursor:ask \"<your question>\"" >&2
  exit 1
fi

bash -c '
  set -euo pipefail
  valid_root() {
    [ -n "${1:-}" ] && [ -f "$1/scripts/cursor-companion.sh" ] && { [ -f "$1/.claude-plugin/plugin.json" ] || [ -f "$1/.codex-plugin/plugin.json" ] || [ -f "$1/.cursor-plugin/plugin.json" ]; }
  }
  HARNESS_PLUGIN_ROOT="${HARNESS_PLUGIN_ROOT:-${CLAUDE_PLUGIN_ROOT:-}}"
  ROOT="$HARNESS_PLUGIN_ROOT"
  if ! valid_root "$ROOT"; then
    ROOT=""
    if [ -n "${CLAUDE_SKILL_DIR:-}" ]; then
      probe="$(cd "${CLAUDE_SKILL_DIR}" && pwd)"
      while [ "$probe" != "/" ] && ! valid_root "$probe"; do
        probe="$(cd "$probe/.." && pwd)"
      done
      valid_root "$probe" && ROOT="$probe"
    fi
  fi
  if ! valid_root "$ROOT"; then
    ROOT=""
    for c in "${CLAUDE_PROJECT_DIR:-}" "$PWD" \
             "$HOME/.claude/plugins/marketplaces/claude-code-harness-marketplace" \
             "$HOME/.claude/plugins/cache/claude-code-harness-marketplace/claude-code-harness/"*; do
      if valid_root "$c"; then ROOT="$c"; break; fi
    done
  fi
  if ! valid_root "$ROOT"; then
    echo "ERROR: claude-code-harness plugin root not found (no scripts/cursor-companion.sh)" >&2
    exit 2
  fi
  HARNESS_PLUGIN_ROOT="$ROOT"
  bash "${HARNESS_PLUGIN_ROOT}/scripts/cursor-companion.sh" task "$1"
' _ "$QUESTION"

With just this, the cursor-agent side will --mode ask is locked to (hard read-only stop).--force / --yolo is also not added.

Step 3: Host summarizes the result in 3-5 lines

Do not paste cursor's output as-is. The host (Claude/Codex) reads it and summarize in 3-5 lines do:

Conclusion
Why this can be said (the core of the rationale cursor provided)
Caveats / points requiring additional investigation
Next move (if any)

After the summary, output the following sentence literally at the end:

↑この結果は host が要約します。Enter キーで次へ進むか、新規 prompt で別の指示を出してください。

Trust Boundary

cursor is an opaque subprocess, and Harness's guardrails (R01-R13) are not applied internally. Even for read-only delegation, the following preconditions must be met.

Required preconditions

Item	Content	Configuration location
Secret blocking	`.cursorignore` で `.env` / `.pem` / `.key` / `.ssh` / `.aws` / `.git` Exclude from read targets	repo root `.cursorignore`
Egress allowlist	`~/.claude/settings.json` の `sandbox.network.allowedDomains` に `*.cursor.sh` Add	user settings
Filesystem allowlist	Same `sandbox.filesystem.allowWrite` に `~/.cursor` Add (because cursor-agent writes state)	user settings
permissions.json	`~/.cursor/permissions.json` の `terminalAllowlist` / `mcpAllowlist` Is effective even in read mode (allowlist is best-effort, not a security boundary)	user config

For details, see .claude/rules/cursor-cli-only.md .

Things that can be omitted in ask mode

Required for normal cursor delegation	Not required in ask mode	Reason
Isolated worktree	Not required	cursor cannot write
Lead diff review	Not required	No diff is produced
cherry-pick	Not required	Same as above
`worker-report.v1` / self_review 5 items	Not required	Because no implementation is performed

Risks that remain nonetheless

Read leakage: .cursorignore If omitted, secret files are passed to cursor inference
Accepting incorrect information at face value: cursor output is untrusted. In the Step 3 summary, the host must always retain the judgment criteria
Overconfidence in the allowlist: Cursor officially states, "Allowlists are best-effort convenience. They are not a security guarantee." Do not depend on the allowlist

Topology

Lead (Claude/Codex) ──[cursor-companion.sh task]──> cursor-agent (--mode ask, locked read-only)
       │
       └──[Step 3: 3-5 行要約]──> User

No Worker involvement. No Reviewer involvement.worker-report.v1 / review-result.v1 No contract arises.

Related Skills / Rules

cursor-do — Write-task delegation (full containment of worktree + Lead review + cherry-pick)
breezing --cursor — Lean second-opinion lane that delegates only the Reviewer to cursor
harness-review --cursor — Request a review from cursor (composer-2.5-fast) as a second opinion
.claude/rules/cursor-cli-only.md — Cursor backend governance (trust boundary, prohibited flags)